mcp-server-bitbucket 0.11.0 → 0.19.0

package/dist/index.js

@@ -3,6 +3,7 @@
 // src/index.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import {
   CallToolRequestSchema,
   ListToolsRequestSchema,
@@ -11,26 +12,374 @@ import {
   ListPromptsRequestSchema,
   GetPromptRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
+import { createServer as createHttpServer } from "http";
+import { pathToFileURL } from "url";
+import { realpathSync } from "fs";
+
+// src/http-input.ts
+var HttpInputError = class extends Error {
+  constructor(message, status = 400) {
+    super(message);
+    this.status = status;
+  }
+};
+async function readHttpBody(source) {
+  const chunks = [];
+  let bytes = 0;
+  for await (const chunk of source) {
+    bytes += chunk.byteLength;
+    if (bytes > 100 * 1024) throw new HttpInputError("Request body exceeds 100 KiB", 413);
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks);
+}
+function parseMcpBody(body) {
+  const parsed = JSON.parse(body.toString("utf8"));
+  if (Array.isArray(parsed)) throw new HttpInputError("JSON-RPC batches are not supported");
+  if (parsed && typeof parsed === "object" && "method" in parsed && parsed.method === "tools/call") {
+    const pending = [parsed];
+    let elements = 0;
+    while (pending.length) {
+      const value = pending.pop();
+      if (value && typeof value === "object") {
+        const values = Object.values(value);
+        elements += values.length;
+        if (elements > 1e3) throw new HttpInputError("Tool input exceeds 1000 elements");
+        pending.push(...values);
+      }
+    }
+  }
+  return parsed;
+}
+
+// src/auth.ts
+import { createRemoteJWKSet, jwtVerify } from "jose";
+function defaultJwksUri(issuer) {
+  const base = issuer.replace(/\/+$/, "").replace(/\/v2\.0$/, "");
+  return `${base}/discovery/v2.0/keys`;
+}
+function getAuthConfig(env = process.env, jwksOverride) {
+  const issuer = (env.MCP_OAUTH_ISSUER || "").trim();
+  const audience = (env.MCP_OAUTH_AUDIENCE || "").trim();
+  if (!issuer || !audience) {
+    return null;
+  }
+  const jwksUri = (env.MCP_OAUTH_JWKS_URI || "").trim() || defaultJwksUri(issuer);
+  const requiredScopes = parseScopes(env.MCP_OAUTH_REQUIRED_SCOPE);
+  const advertisedScopes = parseScopes(env.MCP_OAUTH_SCOPES_SUPPORTED) ?? requiredScopes;
+  const publicUrl = (env.MCP_PUBLIC_URL || "").trim().replace(/\/+$/, "");
+  const resourceUrl = publicUrl ? `${publicUrl}/mcp` : audience;
+  const resourceIdentifier = (env.MCP_OAUTH_RESOURCE || "").trim() || resourceUrl;
+  return {
+    issuer,
+    audience,
+    requiredScopes,
+    advertisedScopes,
+    resourceUrl,
+    resourceIdentifier,
+    proxyAuthorizationServerMetadata: (env.MCP_OAUTH_AS_METADATA || "proxy").trim() !== "issuer",
+    jwks: jwksOverride ?? createRemoteJWKSet(new URL(jwksUri))
+  };
+}
+function parseScopes(raw) {
+  const scopes = (raw || "").split(/[\s,]+/).filter(Boolean);
+  return scopes.length > 0 ? scopes : void 0;
+}
+function protectedResourceMetadata(config) {
+  const scopes = config.advertisedScopes ?? config.requiredScopes;
+  const authorizationServer = config.proxyAuthorizationServerMetadata ? serverOrigin(config) : config.issuer;
+  return {
+    resource: config.resourceIdentifier,
+    authorization_servers: [authorizationServer],
+    bearer_methods_supported: ["header"],
+    ...scopes ? { scopes_supported: scopes } : {}
+  };
+}
+var METADATA_PATHS = [
+  "/.well-known/oauth-protected-resource/mcp",
+  "/.well-known/oauth-protected-resource"
+];
+function serverOrigin(config) {
+  return config.resourceUrl.replace(/\/mcp$/, "");
+}
+function metadataUrl(config) {
+  return `${serverOrigin(config)}${METADATA_PATHS[0]}`;
+}
+var AS_METADATA_PATH = "/.well-known/oauth-authorization-server";
+var asMetadataCache = null;
+var AS_METADATA_TTL_MS = 60 * 60 * 1e3;
+async function authorizationServerMetadata(config, fetchImpl = fetch, now = Date.now()) {
+  if (asMetadataCache && now - asMetadataCache.fetchedAt < AS_METADATA_TTL_MS) {
+    return asMetadataCache.document;
+  }
+  const url = `${config.issuer.replace(/\/+$/, "")}/.well-known/openid-configuration`;
+  const response = await fetchImpl(url);
+  if (!response.ok) {
+    throw new Error(`Could not read OpenID configuration from ${url}: HTTP ${response.status}`);
+  }
+  const upstream = await response.json();
+  const document = {
+    ...upstream,
+    code_challenge_methods_supported: upstream.code_challenge_methods_supported ?? ["S256"],
+    grant_types_supported: upstream.grant_types_supported ?? ["authorization_code", "refresh_token"]
+  };
+  asMetadataCache = { document, fetchedAt: now };
+  return document;
+}
+function wwwAuthenticate(config, failure) {
+  const parts = [
+    `Bearer realm="mcp"`,
+    `resource_metadata="${metadataUrl(config)}"`
+  ];
+  if (failure) {
+    parts.push(`error="${failure.error}"`, `error_description="${failure.description}"`);
+  }
+  return parts.join(", ");
+}
+function tokenScopes(payload) {
+  const scp = payload.scp;
+  if (typeof scp === "string") {
+    return scp.split(" ").filter(Boolean);
+  }
+  if (Array.isArray(scp)) {
+    return scp.filter((s) => typeof s === "string");
+  }
+  const roles = payload.roles;
+  if (Array.isArray(roles)) {
+    return roles.filter((r) => typeof r === "string");
+  }
+  return [];
+}
+async function verifyBearer(authorization, config) {
+  if (!authorization) {
+    return {
+      ok: false,
+      status: 401,
+      error: "invalid_token",
+      description: "Authorization header is required"
+    };
+  }
+  const match = /^Bearer[ ]+(.+)$/i.exec(authorization.trim());
+  if (!match) {
+    return {
+      ok: false,
+      status: 401,
+      error: "invalid_token",
+      description: "Authorization header must use the Bearer scheme"
+    };
+  }
+  let payload;
+  try {
+    const verified = await jwtVerify(match[1], config.jwks, {
+      issuer: config.issuer,
+      audience: config.audience
+    });
+    payload = verified.payload;
+  } catch (error) {
+    return {
+      ok: false,
+      status: 401,
+      error: "invalid_token",
+      description: error instanceof Error ? error.message : "Token verification failed"
+    };
+  }
+  if (config.requiredScopes) {
+    const granted = tokenScopes(payload);
+    if (!config.requiredScopes.some((scope) => granted.includes(scope))) {
+      return {
+        ok: false,
+        status: 403,
+        error: "insufficient_scope",
+        description: `Token carries none of the required scopes: ${config.requiredScopes.join(", ")}`
+      };
+    }
+  }
+  const caller = [payload.preferred_username, payload.upn, payload.appid].find((value) => typeof value === "string" && value.length > 0);
+  return { ok: true, subject: typeof payload.sub === "string" ? payload.sub : void 0, caller };
+}
+
+// src/oauth-proxy.ts
+var AUTHORIZE_PATH = "/oauth/authorize";
+var TOKEN_PATH = "/oauth/token";
+var REGISTER_PATH = "/oauth/register";
+var DEFAULT_REDIRECT_ALLOWLIST = [
+  "https://claude.ai/api/mcp/auth_callback",
+  "https://claude.com/api/mcp/auth_callback"
+];
+function isAllowedRedirect(uri, allowlist) {
+  if (allowlist.includes(uri)) {
+    return true;
+  }
+  try {
+    const parsed = new URL(uri);
+    return parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]");
+  } catch {
+    return false;
+  }
+}
+function getProxyConfig(auth, env = process.env) {
+  const configured = (env.MCP_OAUTH_REDIRECT_ALLOWLIST || "").split(/[\s,]+/).filter(Boolean);
+  return {
+    origin: serverOrigin(auth),
+    clientId: (env.MCP_OAUTH_CLIENT_ID || "").trim(),
+    upstreamScope: (env.MCP_OAUTH_UPSTREAM_SCOPE || "").trim() || [...auth.advertisedScopes ?? [], "offline_access"].join(" ").trim(),
+    redirectAllowlist: configured.length > 0 ? configured : DEFAULT_REDIRECT_ALLOWLIST
+  };
+}
+function proxyAuthorizationServerMetadata(auth, proxy) {
+  return {
+    issuer: proxy.origin,
+    authorization_endpoint: `${proxy.origin}${AUTHORIZE_PATH}`,
+    token_endpoint: `${proxy.origin}${TOKEN_PATH}`,
+    response_types_supported: ["code"],
+    grant_types_supported: ["authorization_code", "refresh_token"],
+    code_challenge_methods_supported: ["S256"],
+    token_endpoint_auth_methods_supported: ["none"],
+    ...proxy.clientId ? { registration_endpoint: `${proxy.origin}${REGISTER_PATH}` } : {},
+    ...auth.advertisedScopes ? { scopes_supported: auth.advertisedScopes } : {}
+  };
+}
+function buildAuthorizeRedirect(requestUrl, proxy, upstreamAuthorizeEndpoint) {
+  const redirectUri = requestUrl.searchParams.get("redirect_uri");
+  if (!redirectUri) {
+    return { status: 400, error: "invalid_request", description: "redirect_uri is required" };
+  }
+  if (!isAllowedRedirect(redirectUri, proxy.redirectAllowlist)) {
+    return {
+      status: 400,
+      error: "invalid_request",
+      description: "redirect_uri is not allowed for this server"
+    };
+  }
+  const upstream = new URL(upstreamAuthorizeEndpoint);
+  const passthrough = [
+    "client_id",
+    "response_type",
+    "redirect_uri",
+    "state",
+    "code_challenge",
+    "code_challenge_method",
+    "prompt",
+    "login_hint"
+  ];
+  for (const name of passthrough) {
+    const value = requestUrl.searchParams.get(name);
+    if (value !== null) {
+      upstream.searchParams.set(name, value);
+    }
+  }
+  upstream.searchParams.set("scope", proxy.upstreamScope);
+  return { status: 302, location: upstream.toString() };
+}
+function buildTokenRequestBody(rawBody) {
+  const params = new URLSearchParams(rawBody);
+  params.delete("resource");
+  return params;
+}
+async function forwardTokenRequest(rawBody, authorizationHeader, upstreamTokenEndpoint, fetchImpl = fetch) {
+  const response = await fetchImpl(upstreamTokenEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      ...authorizationHeader ? { Authorization: authorizationHeader } : {}
+    },
+    body: buildTokenRequestBody(rawBody).toString()
+  });
+  return {
+    status: response.status,
+    body: await response.text(),
+    contentType: response.headers.get("content-type") ?? "application/json"
+  };
+}
+async function resolveUpstreamEndpoints(auth, fetchImpl = fetch) {
+  const metadata = await authorizationServerMetadata(auth, fetchImpl);
+  const authorize = metadata.authorization_endpoint;
+  const token = metadata.token_endpoint;
+  if (typeof authorize !== "string" || typeof token !== "string") {
+    throw new Error("Issuer configuration is missing authorization_endpoint or token_endpoint");
+  }
+  return { authorize, token };
+}
+function redactUrlForLog(url) {
+  const [path, query] = url.split("?");
+  return query ? `${path}?<redacted>` : path;
+}
+function registerClient(request, proxy) {
+  if (!proxy.clientId) {
+    return {
+      status: 400,
+      error: "invalid_request",
+      description: "This server has no upstream client configured"
+    };
+  }
+  const body = request ?? {};
+  const redirectUris = Array.isArray(body.redirect_uris) ? body.redirect_uris : [];
+  if (redirectUris.length === 0) {
+    return { status: 400, error: "invalid_redirect_uri", description: "redirect_uris is required" };
+  }
+  const rejected = redirectUris.filter(
+    (uri) => typeof uri !== "string" || !isAllowedRedirect(uri, proxy.redirectAllowlist)
+  );
+  if (rejected.length > 0) {
+    return {
+      status: 400,
+      error: "invalid_redirect_uri",
+      description: "redirect_uris are not allowed for this server"
+    };
+  }
+  return {
+    status: 201,
+    body: {
+      client_id: proxy.clientId,
+      redirect_uris: redirectUris,
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      client_id_issued_at: Math.floor(Date.now() / 1e3),
+      ...typeof body.client_name === "string" ? { client_name: body.client_name } : {}
+    }
+  };
+}
 
 // src/settings.ts
 import { z } from "zod";
 var settingsSchema = z.object({
   bitbucketWorkspace: z.string().min(1, "BITBUCKET_WORKSPACE is required"),
-  bitbucketEmail: z.string().min(1, "BITBUCKET_EMAIL is required"),
-  bitbucketApiToken: z.string().min(1, "BITBUCKET_API_TOKEN is required"),
+  bitbucketEmail: z.string().default(""),
+  bitbucketApiToken: z.string().min(1, "BITBUCKET_API_TOKEN (or BITBUCKET_OAUTH_TOKEN) is required"),
+  bitbucketAuthType: z.enum(["basic", "bearer"]),
   apiTimeout: z.number().min(1).max(300).default(30),
   maxRetries: z.number().min(0).max(10).default(3),
   outputFormat: z.enum(["json", "toon"]).default("json")
-});
+}).refine(
+  (s) => s.bitbucketAuthType !== "basic" || s.bitbucketEmail.length > 0,
+  { message: "BITBUCKET_EMAIL is required when using basic auth", path: ["bitbucketEmail"] }
+);
 var cachedSettings = null;
+function resolveAuthType(explicit, oauthToken, email) {
+  const normalized = explicit.trim().toLowerCase();
+  if (normalized === "bearer" || normalized === "basic") {
+    return normalized;
+  }
+  if (oauthToken.length > 0 || email.length === 0) {
+    return "bearer";
+  }
+  return "basic";
+}
 function getSettings() {
   if (cachedSettings) {
     return cachedSettings;
   }
+  const email = process.env.BITBUCKET_EMAIL || "";
+  const oauthToken = process.env.BITBUCKET_OAUTH_TOKEN || "";
+  const apiToken = process.env.BITBUCKET_API_TOKEN || "";
+  const authType = resolveAuthType(process.env.BITBUCKET_AUTH_TYPE || "", oauthToken, email);
   const rawSettings = {
     bitbucketWorkspace: process.env.BITBUCKET_WORKSPACE || "",
-    bitbucketEmail: process.env.BITBUCKET_EMAIL || "",
-    bitbucketApiToken: process.env.BITBUCKET_API_TOKEN || "",
+    bitbucketEmail: email,
+    // Bearer mode prefers the dedicated OAuth/access token when both are set
+    bitbucketApiToken: authType === "bearer" ? oauthToken || apiToken : apiToken,
+    bitbucketAuthType: authType,
     apiTimeout: parseInt(process.env.API_TIMEOUT || "30", 10),
     maxRetries: parseInt(process.env.MAX_RETRIES || "3", 10),
     outputFormat: process.env.OUTPUT_FORMAT || "json"
@@ -94,19 +443,26 @@ var BitbucketClient = class _BitbucketClient {
   workspace;
   client;
   maxRetries;
+  requestTimeout;
   constructor() {
     const settings = getSettings();
     this.workspace = settings.bitbucketWorkspace;
     this.maxRetries = settings.maxRetries;
+    this.requestTimeout = settings.apiTimeout * 1e3;
+    const useBearer = settings.bitbucketAuthType === "bearer";
     this.client = axios.create({
       baseURL: _BitbucketClient.BASE_URL,
-      timeout: settings.apiTimeout * 1e3,
-      auth: {
-        username: settings.bitbucketEmail,
-        password: settings.bitbucketApiToken
+      timeout: this.requestTimeout,
+      paramsSerializer: { indexes: null },
+      ...useBearer ? {} : {
+        auth: {
+          username: settings.bitbucketEmail,
+          password: settings.bitbucketApiToken
+        }
       },
       headers: {
-        "Content-Type": "application/json"
+        "Content-Type": "application/json",
+        ...useBearer ? { Authorization: `Bearer ${settings.bitbucketApiToken}` } : {}
       }
     });
   }
@@ -117,103 +473,126 @@ var BitbucketClient = class _BitbucketClient {
     const base = `repositories/${this.workspace}/${repoSlug}`;
     return parts.length > 0 ? `${base}/${parts.join("/")}` : base;
   }
-  /**
-   * Make an API request with retry logic for rate limiting
-   */
-  async request(method, path, data, params) {
+  encodeRef(ref) {
+    if (!ref || ref.split("/").some((part) => part === "." || part === "..")) throw new BitbucketError("Invalid revision name");
+    return encodeURIComponent(ref);
+  }
+  encodeFilePath(path) {
+    if (path.startsWith("/") || path.split("/").some((part) => part === "." || part === "..")) {
+      throw new BitbucketError("Invalid repository file path");
+    }
+    return path.split("/").map(encodeURIComponent).join("/");
+  }
+  /** Retry only reads after ambiguous network/server failures; writes may retry 429. */
+  async request(method, path, data, params, text = false) {
     let backoff = _BitbucketClient.INITIAL_BACKOFF;
+    let slept = 0;
+    const deadline = performance.now() + this.requestTimeout;
     for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
+      const remaining = deadline - performance.now();
+      if (remaining <= 0) throw new BitbucketError("Request retry budget exhausted", void 0, method, path);
       try {
         const response = await this.client.request({
           method,
           url: path,
           data,
-          params
+          params,
+          timeout: Math.max(1, Math.floor(remaining)),
+          ...text ? { responseType: "text", transformResponse: [(value) => value] } : {}
         });
         return response.data;
       } catch (error) {
-        if (axios.isAxiosError(error)) {
-          const axiosError = error;
-          if (axiosError.response?.status === 404) {
-            return null;
+        if (!axios.isAxiosError(error)) throw error;
+        const status = error.response?.status;
+        if (status === 404) return null;
+        const abortedBody = error.code === "ERR_BAD_RESPONSE" && error.message === "stream has been aborted";
+        const network = abortedBody || !error.response && ["ECONNRESET", "ECONNREFUSED", "ECONNABORTED", "ETIMEDOUT", "EPIPE", "EAI_AGAIN", "ENOTFOUND", "ERR_NETWORK"].includes(error.code || "");
+        const retryable = status === 429 || method === "GET" && (network || [502, 503, 504].includes(status ?? 0));
+        if (retryable && attempt < this.maxRetries) {
+          const header = error.response?.headers["retry-after"];
+          let wait = backoff;
+          if (typeof header === "string" && header.trim()) {
+            const numeric = Number(header);
+            const dated = /[a-z]/i.test(header) && !["nan", "inf", "infinity"].includes(header.toLowerCase()) ? Date.parse(header) - Date.now() : NaN;
+            const parsed = Number.isFinite(numeric) && numeric >= 0 ? numeric * 1e3 : dated;
+            if (Number.isFinite(parsed) && parsed >= 0) wait = parsed;
           }
-          if (axiosError.response?.status === 429) {
-            if (attempt < this.maxRetries) {
-              const retryAfter = axiosError.response.headers["retry-after"];
-              const waitTime = retryAfter ? parseInt(retryAfter, 10) * 1e3 : backoff;
-              await sleep(waitTime);
-              backoff *= 2;
-              continue;
-            }
-            throw new BitbucketError(
-              `Rate limited after ${this.maxRetries} retries`,
-              429,
-              method,
-              path
-            );
+          if (wait > 15e3 - slept || wait >= deadline - performance.now()) {
+            throw new BitbucketError("Retry-After exceeds request retry budget; retry later", status, method, path);
           }
-          const statusCode = axiosError.response?.status;
-          const errorText = JSON.stringify(axiosError.response?.data || axiosError.message).substring(0, 500);
-          throw new BitbucketError(
-            `API error ${statusCode}: ${errorText}`,
-            statusCode,
-            method,
-            path
-          );
+          await sleep(wait);
+          slept += wait;
+          backoff *= 2;
+          continue;
         }
-        throw error;
+        throw new BitbucketError(
+          network ? `Network request failed after ${attempt + 1} attempt(s)` : `API error ${status ?? "unknown"}`,
+          status,
+          method,
+          path
+        );
       }
     }
-    throw new BitbucketError(`Unexpected error in request`, void 0, method, path);
+    throw new BitbucketError("Request retry budget exhausted", void 0, method, path);
   }
-  /**
-   * Make a request that returns plain text
-   */
-  async requestText(path) {
-    let backoff = _BitbucketClient.INITIAL_BACKOFF;
-    for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
+  requestText(path, params) {
+    return this.request("GET", path, void 0, params, true);
+  }
+  /** A next link can change only query parameters, never the authenticated endpoint. */
+  validateCursor(cursor, endpoint) {
+    const expected = new URL(endpoint, _BitbucketClient.BASE_URL + "/");
+    let parsed;
+    try {
+      parsed = new URL(cursor);
+    } catch {
+      throw new BitbucketError("Invalid pagination cursor");
+    }
+    const rawPath = cursor.split(/[?#]/, 1)[0].replace(/^https:\/\/[^/]+/, "");
+    const segments = rawPath.split("/");
+    const unsafeSegments = segments.some((segment) => {
+      let decoded;
       try {
-        const response = await this.client.get(path, {
-          responseType: "text"
-        });
-        return response.data;
-      } catch (error) {
-        if (axios.isAxiosError(error)) {
-          if (error.response?.status === 404) {
-            return null;
-          }
-          if (error.response?.status === 429) {
-            if (attempt < this.maxRetries) {
-              const retryAfter = error.response.headers["retry-after"];
-              const waitTime = retryAfter ? parseInt(retryAfter, 10) * 1e3 : backoff;
-              await sleep(waitTime);
-              backoff *= 2;
-              continue;
-            }
-          }
-          throw new BitbucketError(`Request failed: ${error.response?.status}`);
-        }
-        throw error;
+        decoded = decodeURIComponent(segment);
+      } catch {
+        return true;
       }
+      return decoded === "." || decoded === ".." || decoded.includes("\\");
+    });
+    if (parsed.protocol !== "https:" || parsed.hostname !== "api.bitbucket.org" || parsed.port && parsed.port !== "443" || parsed.username || parsed.password || parsed.hash || cursor.includes("\\") || unsafeSegments || parsed.pathname.replace(/\/$/, "") !== expected.pathname.replace(/\/$/, "")) {
+      throw new BitbucketError("Invalid pagination cursor for this endpoint");
     }
-    return null;
+    return cursor;
+  }
+  async historyPage(endpoint, options = {}, allowMissing = false) {
+    const { limit = 50, cursor, maxPage = 100, ...filters } = options;
+    const params = { pagelen: Math.min(Math.max(1, Math.floor(limit)), maxPage), ...filters };
+    for (const key of Object.keys(params)) if (params[key] === void 0) delete params[key];
+    const result = await this.request(
+      "GET",
+      cursor ? this.validateCursor(cursor, endpoint) : endpoint,
+      void 0,
+      cursor ? void 0 : params
+    );
+    if (result === null && !allowMissing) {
+      throw new BitbucketError("History resource or revision not found (404)", 404, "GET", endpoint);
+    }
+    const next = result?.next ? this.validateCursor(result.next, endpoint) : null;
+    return { values: result?.values ?? [], has_more: next !== null, next_cursor: next };
   }
-  /**
-   * Helper for paginated list endpoints
-   */
   async paginatedList(endpoint, options = {}) {
-    const { limit = 50, maxPage = 100, ...extraParams } = options;
-    const params = {
-      pagelen: Math.min(limit, maxPage),
-      ...extraParams
-    };
-    Object.keys(params).forEach((key) => {
-      if (params[key] === void 0) {
-        delete params[key];
-      }
-    });
-    const result = await this.request("GET", endpoint, void 0, params);
-    return result?.values || [];
+    const limit = Math.max(1, Math.floor(options.limit ?? 50));
+    const values = [];
+    const visited = /* @__PURE__ */ new Set();
+    let cursor;
+    for (let pageCount = 0; pageCount < 1e3; pageCount++) {
+      const page = await this.historyPage(endpoint, { ...options, cursor }, true);
+      values.push(...page.values);
+      if (values.length >= limit || !page.next_cursor) return values.slice(0, limit);
+      if (visited.has(page.next_cursor)) throw new BitbucketError("Repeated pagination cursor");
+      visited.add(page.next_cursor);
+      cursor = page.next_cursor;
+    }
+    throw new BitbucketError("Pagination page budget exhausted");
   }
   // ==================== REPOSITORIES ====================
   async getRepository(repoSlug) {
@@ -505,6 +884,35 @@ var BitbucketClient = class _BitbucketClient {
     const result = await this.getPipeline(repoSlug, pipelineUuid);
     return result || { uuid: pipelineUuid, state: { name: "STOPPED" } };
   }
+  // ==================== PIPELINE CONFIG ====================
+  async getPipelineConfig(repoSlug) {
+    const result = await this.request(
+      "GET",
+      this.repoPath(repoSlug, "pipelines_config")
+    );
+    if (!result) {
+      throw new BitbucketError(`Failed to get pipeline config for: ${repoSlug}`);
+    }
+    return result;
+  }
+  async updatePipelineConfig(repoSlug, options) {
+    const payload = {};
+    if (options.enabled !== void 0) {
+      payload.enabled = options.enabled;
+    }
+    if (Object.keys(payload).length === 0) {
+      throw new BitbucketError("No fields to update");
+    }
+    const result = await this.request(
+      "PUT",
+      this.repoPath(repoSlug, "pipelines_config"),
+      payload
+    );
+    if (!result) {
+      throw new BitbucketError(`Failed to update pipeline config for: ${repoSlug}`);
+    }
+    return result;
+  }
   // ==================== PIPELINE VARIABLES ====================
   async listPipelineVariables(repoSlug, options = {}) {
     return this.paginatedList(
@@ -553,21 +961,65 @@ var BitbucketClient = class _BitbucketClient {
     });
   }
   async getBranch(repoSlug, branchName) {
-    return this.request("GET", this.repoPath(repoSlug, "refs", "branches", branchName));
+    return this.request("GET", this.repoPath(repoSlug, "refs", "branches", this.encodeRef(branchName)));
   }
   // ==================== COMMITS ====================
   async listCommits(repoSlug, options = {}) {
     return this.paginatedList(this.repoPath(repoSlug, "commits"), {
-      limit: options.limit || 20,
-      include: options.branch,
+      limit: options.limit ?? 20,
+      include: [...options.branch ? [options.branch] : [], ...options.include ?? []],
+      exclude: options.exclude,
+      path: options.path
+    });
+  }
+  listCommitsPage(repoSlug, options = {}) {
+    return this.historyPage(this.repoPath(repoSlug, "commits"), {
+      limit: options.limit ?? 20,
+      cursor: options.cursor,
+      include: [...options.branch ? [options.branch] : [], ...options.include ?? []],
+      exclude: options.exclude,
       path: options.path
     });
   }
   async getCommit(repoSlug, commit) {
-    return this.request("GET", this.repoPath(repoSlug, "commit", commit));
+    return this.request("GET", this.repoPath(repoSlug, "commit", this.encodeRef(commit)));
+  }
+  compareCommits(repoSlug, base, head) {
+    return this.request("GET", this.repoPath(repoSlug, "diffstat", this.revisionRange(base, head)), void 0, { topic: false });
+  }
+  async resolveComparisonRef(repoSlug, ref) {
+    this.encodeRef(ref);
+    const commit = await this.getCommit(repoSlug, ref);
+    if (!commit) throw new BitbucketError("Commit or revision not found (404)", 404, "GET");
+    if (!/^[a-fA-F0-9]{12,40}$/.test(commit.hash)) throw new BitbucketError("Invalid commit hash returned by Bitbucket");
+    return commit.hash.slice(0, 12).toLowerCase();
+  }
+  async compareCommitsPage(repoSlug, base, head, options = {}) {
+    const canonicalBase = await this.resolveComparisonRef(repoSlug, base);
+    const canonicalHead = await this.resolveComparisonRef(repoSlug, head);
+    return this.historyPage(this.repoPath(repoSlug, "diffstat", this.revisionRange(canonicalBase, canonicalHead)), {
+      limit: options.limit ?? 50,
+      cursor: options.cursor,
+      path: options.path,
+      topic: false
+    });
   }
-  async compareCommits(repoSlug, base, head) {
-    return this.request("GET", this.repoPath(repoSlug, "diffstat", `${base}..${head}`));
+  /** Bitbucket takes the source first, the opposite of git diff base head. */
+  revisionRange(base, head) {
+    return `${this.encodeRef(head)}..${this.encodeRef(base)}`;
+  }
+  getCommitDiff(repoSlug, base, head, options = {}) {
+    return this.requestText(this.repoPath(repoSlug, "diff", this.revisionRange(base, head)), { topic: false, path: options.path });
+  }
+  getMergeBase(repoSlug, base, head) {
+    return this.request("GET", this.repoPath(repoSlug, "merge-base", this.revisionRange(base, head)));
+  }
+  getFileHistory(repoSlug, path, ref = "main", options = {}) {
+    if (!path) throw new BitbucketError("File history requires a file path");
+    return this.historyPage(this.repoPath(repoSlug, "filehistory", this.encodeRef(ref), this.encodeFilePath(path)), {
+      limit: options.limit ?? 20,
+      cursor: options.cursor
+    });
   }
   async getCommitStatuses(repoSlug, commit, options = {}) {
     return this.paginatedList(this.repoPath(repoSlug, "commit", commit, "statuses"), {
@@ -654,10 +1106,22 @@ var BitbucketClient = class _BitbucketClient {
   // ==================== TAGS ====================
   async listTags(repoSlug, options = {}) {
     return this.paginatedList(this.repoPath(repoSlug, "refs", "tags"), {
-      limit: options.limit || 50,
-      sort: "-target.date"
+      limit: options.limit ?? 50,
+      sort: options.sort ?? "-target.date",
+      q: options.query
+    });
+  }
+  listTagsPage(repoSlug, options = {}) {
+    return this.historyPage(this.repoPath(repoSlug, "refs", "tags"), {
+      limit: options.limit ?? 50,
+      cursor: options.cursor,
+      sort: options.sort ?? "-target.date",
+      q: options.query
     });
   }
+  getTag(repoSlug, tagName) {
+    return this.request("GET", this.repoPath(repoSlug, "refs", "tags", this.encodeRef(tagName)));
+  }
   async createTag(repoSlug, name, target, message) {
     const payload = {
       name,
@@ -677,7 +1141,7 @@ var BitbucketClient = class _BitbucketClient {
     return result;
   }
   async deleteTag(repoSlug, tagName) {
-    await this.request("DELETE", this.repoPath(repoSlug, "refs", "tags", tagName));
+    await this.request("DELETE", this.repoPath(repoSlug, "refs", "tags", this.encodeRef(tagName)));
   }
   // ==================== BRANCH RESTRICTIONS ====================
   async listBranchRestrictions(repoSlug, options = {}) {
@@ -717,10 +1181,10 @@ var BitbucketClient = class _BitbucketClient {
   }
   // ==================== SOURCE ====================
   async getFileContent(repoSlug, path, ref = "main") {
-    return this.requestText(this.repoPath(repoSlug, "src", ref, path));
+    return this.requestText(this.repoPath(repoSlug, "src", this.encodeRef(ref), this.encodeFilePath(path)));
   }
   async listDirectory(repoSlug, path = "", options = {}) {
-    const endpoint = path ? this.repoPath(repoSlug, "src", options.ref || "main", path) : this.repoPath(repoSlug, "src", options.ref || "main");
+    const endpoint = path ? this.repoPath(repoSlug, "src", this.encodeRef(options.ref || "main"), this.encodeFilePath(path)) : this.repoPath(repoSlug, "src", this.encodeRef(options.ref || "main"));
     return this.paginatedList(endpoint, { limit: options.limit || 100 });
   }
   // ==================== PERMISSIONS ====================
@@ -1459,6 +1923,29 @@ var definitions3 = [
       },
       required: ["repo_slug", "variable_uuid"]
     }
+  },
+  {
+    name: "get_pipeline_config",
+    description: "Get pipeline configuration for a repository (check if pipelines are enabled).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repo_slug: { type: "string", description: "Repository slug" }
+      },
+      required: ["repo_slug"]
+    }
+  },
+  {
+    name: "update_pipeline_config",
+    description: "Update pipeline configuration for a repository (enable or disable pipelines).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repo_slug: { type: "string", description: "Repository slug" },
+        enabled: { type: "boolean", description: "Enable or disable pipelines" }
+      },
+      required: ["repo_slug", "enabled"]
+    }
   }
 ];
 var handlers3 = {
@@ -1598,6 +2085,22 @@ var handlers3 = {
     const client = getClient();
     await client.deletePipelineVariable(args.repo_slug, args.variable_uuid);
     return {};
+  },
+  get_pipeline_config: async (args) => {
+    const client = getClient();
+    const result = await client.getPipelineConfig(args.repo_slug);
+    return {
+      enabled: result.enabled
+    };
+  },
+  update_pipeline_config: async (args) => {
+    const client = getClient();
+    const result = await client.updatePipelineConfig(args.repo_slug, {
+      enabled: args.enabled
+    });
+    return {
+      enabled: result.enabled
+    };
   }
 };
 
@@ -1665,12 +2168,15 @@ var handlers4 = {
 var definitions5 = [
   {
     name: "list_commits",
-    description: "List commits in a repository.",
+    description: "List a page of commits. Use include/exclude for commits between revisions (include=head, exclude=base); continue with next_cursor until has_more is false.",
     inputSchema: {
       type: "object",
       properties: {
         repo_slug: { type: "string", description: "Repository slug" },
-        branch: { type: "string", description: "Filter by branch name (optional)" },
+        branch: { type: "string", description: "Branch, tag or SHA to include (alias for include)" },
+        include: { type: "array", items: { type: "string" }, description: "Include commits reachable from these branches, tags or SHAs" },
+        exclude: { type: "array", items: { type: "string" }, description: "Exclude commits reachable from these revisions" },
+        cursor: { type: "string", description: "Opaque next_cursor from this tool; retains its page size and filters" },
         path: { type: "string", description: "Filter by file path - only commits that modified this path (optional)" },
         limit: { type: "number", description: "Maximum results (default: 20)", default: 20 }
       },
@@ -1691,17 +2197,45 @@ var definitions5 = [
   },
   {
     name: "compare_commits",
-    description: "Compare two commits or branches and see files changed.",
+    description: "Compare base to head (branches, tags or SHAs). Returns a page of changed files and line counts; follow next_cursor for all files.",
     inputSchema: {
       type: "object",
       properties: {
         repo_slug: { type: "string", description: "Repository slug" },
         base: { type: "string", description: "Base commit hash or branch name" },
-        head: { type: "string", description: "Head commit hash or branch name" }
+        head: { type: "string", description: "Head commit hash, tag or branch name" },
+        path: { type: "string", description: "Optional file path filter" },
+        limit: { type: "integer", minimum: 1, maximum: 100, default: 50 },
+        cursor: { type: "string", description: "Opaque next_cursor; retains page size and filters" }
+      },
+      required: ["repo_slug", "base", "head"]
+    }
+  },
+  {
+    name: "get_commit_diff",
+    description: "Get the raw Git-style diff from base to head. Continue large diffs with next_offset; pin revisions to commit hashes while paging. API-side diff limits still apply.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repo_slug: { type: "string" },
+        base: { type: "string" },
+        head: { type: "string" },
+        path: { type: "string", description: "Optional file path filter" },
+        offset: { type: "integer", minimum: 0, default: 0 },
+        max_chars: { type: "integer", minimum: 1, maximum: 1e5, default: 2e4 }
       },
       required: ["repo_slug", "base", "head"]
     }
   },
+  {
+    name: "get_merge_base",
+    description: "Get a best common ancestor of two branches, tags or commit hashes. Bitbucket returns one ancestor when multiple best ancestors exist.",
+    inputSchema: {
+      type: "object",
+      properties: { repo_slug: { type: "string" }, base: { type: "string" }, head: { type: "string" } },
+      required: ["repo_slug", "base", "head"]
+    }
+  },
   {
     name: "get_commit_statuses",
     description: "Get build/CI statuses for a commit.",
@@ -1736,18 +2270,18 @@ var definitions5 = [
 var handlers5 = {
   list_commits: async (args) => {
     const client = getClient();
-    const commits = await client.listCommits(args.repo_slug, {
+    const page = await client.listCommitsPage(args.repo_slug, {
       branch: args.branch,
+      include: args.include,
+      exclude: args.exclude,
       path: args.path,
-      limit: validateLimit(args.limit || 20)
+      cursor: args.cursor,
+      limit: validateLimit(args.limit ?? 20)
     });
     return {
-      commits: commits.map((c) => ({
-        hash: truncateHash(c.hash),
-        message: c.message,
-        author: c.author?.raw,
-        date: c.date
-      }))
+      commits: page.values.map((c) => ({ hash: truncateHash(c.hash), message: c.message, author: c.author?.raw, date: c.date })),
+      has_more: page.has_more,
+      next_cursor: page.next_cursor
     };
   },
   get_commit: async (args) => {
@@ -1766,24 +2300,33 @@ var handlers5 = {
   },
   compare_commits: async (args) => {
     const client = getClient();
-    const result = await client.compareCommits(
-      args.repo_slug,
-      args.base,
-      args.head
-    );
-    if (!result) {
-      return { error: `Could not compare ${args.base}..${args.head}` };
-    }
-    const files = result.values || [];
+    const page = await client.compareCommitsPage(args.repo_slug, args.base, args.head, {
+      path: args.path,
+      limit: validateLimit(args.limit ?? 50),
+      cursor: args.cursor
+    });
+    const files = page.values;
     return {
-      files: files.slice(0, 50).map((f) => ({
-        path: f.new?.path || f.old?.path,
-        status: f.status,
-        "+": f.lines_added || 0,
-        "-": f.lines_removed || 0
-      }))
+      files: files.map((f) => ({ path: f.new?.path || f.old?.path, status: f.status, "+": f.lines_added || 0, "-": f.lines_removed || 0 })),
+      has_more: page.has_more,
+      next_cursor: page.next_cursor
     };
   },
+  get_commit_diff: async (args) => {
+    const offset = args.offset === void 0 ? 0 : Number(args.offset);
+    const maxChars = args.max_chars === void 0 ? 2e4 : Number(args.max_chars);
+    if (!Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(maxChars) || maxChars < 1 || maxChars > 1e5) {
+      return { success: false, error: "offset must be a nonnegative integer; max_chars must be an integer between 1 and 100000" };
+    }
+    const diff = await getClient().getCommitDiff(args.repo_slug, args.base, args.head, { path: args.path });
+    if (diff === null) return notFoundResponse("Diff", `${args.base}..${args.head}`);
+    const end = Math.min(offset + maxChars, diff.length);
+    return { diff: diff.slice(offset, end), offset, next_offset: end < diff.length ? end : null, truncated: end < diff.length, total_chars: diff.length };
+  },
+  get_merge_base: async (args) => {
+    const result = await getClient().getMergeBase(args.repo_slug, args.base, args.head);
+    return result ? { hash: result.hash, message: result.message, author: result.author?.raw, date: result.date, parents: result.parents?.map((p) => truncateHash(p.hash)) } : notFoundResponse("Common ancestor", `${args.base}..${args.head}`);
+  },
   get_commit_statuses: async (args) => {
     const client = getClient();
     const statuses = await client.getCommitStatuses(args.repo_slug, args.commit, {
@@ -2031,16 +2574,24 @@ var handlers7 = {
 var definitions8 = [
   {
     name: "list_tags",
-    description: "List tags in a repository.",
+    description: "List a page of tags, optionally filtered with Bitbucket query syntax and sorted (name uses natural version order). Follow next_cursor for all tags.",
     inputSchema: {
       type: "object",
       properties: {
         repo_slug: { type: "string", description: "Repository slug" },
-        limit: { type: "number", description: "Maximum results (default: 50)", default: 50 }
+        limit: { type: "integer", minimum: 1, maximum: 100, default: 50 },
+        query: { type: "string", description: 'Bitbucket filter, e.g. name ~ "v2" or target.hash = "full-sha"' },
+        sort: { type: "string", description: "Sort field, e.g. name, -name, -target.date", default: "-target.date" },
+        cursor: { type: "string", description: "Opaque next_cursor; retains page size and filters" }
       },
       required: ["repo_slug"]
     }
   },
+  {
+    name: "get_tag",
+    description: "Get a specific tag and its target commit without scanning tag pages.",
+    inputSchema: { type: "object", properties: { repo_slug: { type: "string" }, tag_name: { type: "string" } }, required: ["repo_slug", "tag_name"] }
+  },
   {
     name: "create_tag",
     description: "Create a new tag in a repository.",
@@ -2071,19 +2622,28 @@ var definitions8 = [
 var handlers8 = {
   list_tags: async (args) => {
     const client = getClient();
-    const tags = await client.listTags(args.repo_slug, {
-      limit: validateLimit(args.limit || 50)
+    const page = await client.listTagsPage(args.repo_slug, {
+      limit: validateLimit(args.limit ?? 50),
+      query: args.query,
+      sort: args.sort,
+      cursor: args.cursor
     });
     return {
-      tags: tags.map((t) => ({
+      tags: page.values.map((t) => ({
         name: t.name,
         target: truncateHash(t.target?.hash),
         message: t.message,
         date: t.target?.date,
         tagger: t.tagger?.raw
-      }))
+      })),
+      has_more: page.has_more,
+      next_cursor: page.next_cursor
     };
   },
+  get_tag: async (args) => {
+    const tag = await getClient().getTag(args.repo_slug, args.tag_name);
+    return tag ? { name: tag.name, target: tag.target?.hash, message: tag.message, date: tag.date, tagger: tag.tagger?.raw } : notFoundResponse("Tag", args.tag_name);
+  },
   create_tag: async (args) => {
     const client = getClient();
     const result = await client.createTag(
@@ -2204,6 +2764,21 @@ var definitions10 = [
       required: ["repo_slug", "path"]
     }
   },
+  {
+    name: "get_file_history",
+    description: "List file-history paths and full commit hashes at a branch, tag or SHA. Use get_commit for author, message and date. Follow next_cursor for older changes.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repo_slug: { type: "string" },
+        path: { type: "string" },
+        ref: { type: "string", default: "main" },
+        limit: { type: "integer", minimum: 1, maximum: 100, default: 20 },
+        cursor: { type: "string", description: "Opaque next_cursor; retains page size and filters" }
+      },
+      required: ["repo_slug", "path"]
+    }
+  },
   {
     name: "list_directory",
     description: "List contents of a directory in a repository. Browse repository structure without cloning.",
@@ -2234,6 +2809,17 @@ var handlers10 = {
       size: content.length
     };
   },
+  get_file_history: async (args) => {
+    const page = await getClient().getFileHistory(args.repo_slug, args.path, args.ref || "main", {
+      limit: validateLimit(args.limit ?? 20),
+      cursor: args.cursor
+    });
+    return {
+      history: page.values.map((entry) => ({ path: entry.path, commit: { hash: entry.commit.hash } })),
+      has_more: page.has_more,
+      next_cursor: page.next_cursor
+    };
+  },
   list_directory: async (args) => {
     const client = getClient();
     const ref = args.ref || "main";
@@ -2873,7 +3459,7 @@ Summarize:
 }
 
 // src/index.ts
-var VERSION = "0.10.0";
+var VERSION = "0.19.0";
 function createServer() {
   const server = new Server(
     {
@@ -2958,6 +3544,180 @@ function createServer() {
   });
   return server;
 }
+async function startStdio() {
+  const server = createServer();
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  console.error(`Bitbucket MCP Server v${VERSION} started (stdio)`);
+}
+function createHttpHandler() {
+  const sessions = /* @__PURE__ */ new Map();
+  const auth = getAuthConfig();
+  const proxy = auth ? getProxyConfig(auth) : null;
+  return async (req, res) => {
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS, DELETE");
+    res.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type, mcp-session-id");
+    res.setHeader("Access-Control-Expose-Headers", "mcp-session-id");
+    if (req.method === "OPTIONS") {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+    const clientIp = req.headers["x-forwarded-for"]?.split(",")[0]?.trim() ?? req.socket.remoteAddress ?? "unknown";
+    res.on("finish", () => {
+      console.error(
+        `${req.method} ${redactUrlForLog(req.url ?? "")} -> ${res.statusCode} from ${clientIp}${callerLabel ? ` (${callerLabel})` : ""}`
+      );
+    });
+    let callerLabel = "";
+    if (req.method === "GET" && req.url === "/health") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ status: "ok", version: VERSION }));
+      return;
+    }
+    if (auth && req.method === "GET" && METADATA_PATHS.includes(req.url || "")) {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(protectedResourceMetadata(auth)));
+      return;
+    }
+    if (auth && proxy && req.method === "GET" && req.url === AS_METADATA_PATH) {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(proxyAuthorizationServerMetadata(auth, proxy)));
+      return;
+    }
+    if (auth && proxy && req.method === "GET" && req.url?.startsWith(AUTHORIZE_PATH)) {
+      try {
+        const { authorize } = await resolveUpstreamEndpoints(auth);
+        const requestUrl = new URL(req.url, proxy.origin);
+        const result = buildAuthorizeRedirect(requestUrl, proxy, authorize);
+        if (result.status === 302) {
+          res.writeHead(302, { Location: result.location });
+          res.end();
+        } else {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: result.error, error_description: result.description }));
+        }
+      } catch (error) {
+        console.error(`Authorization request could not be forwarded: ${error}`);
+        res.writeHead(502, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "authorization_server_unavailable" }));
+      }
+      return;
+    }
+    if (auth && proxy && req.method === "POST" && req.url === REGISTER_PATH) {
+      let parsed = {};
+      try {
+        parsed = JSON.parse((await readHttpBody(req.iterator({ destroyOnReturn: false }))).toString("utf8") || "{}");
+      } catch (error) {
+        const status = error instanceof HttpInputError ? error.status : 400;
+        res.writeHead(status, { "Content-Type": "application/json", Connection: "close" });
+        res.end(JSON.stringify({ error: "invalid_request", error_description: error instanceof HttpInputError ? error.message : "Body must be JSON" }));
+        return;
+      }
+      const result = registerClient(parsed, proxy);
+      if (result.status === 201) {
+        res.writeHead(201, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(result.body));
+      } else {
+        res.writeHead(result.status, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: result.error, error_description: result.description }));
+      }
+      return;
+    }
+    if (auth && proxy && req.method === "POST" && req.url === TOKEN_PATH) {
+      try {
+        const body = await readHttpBody(req.iterator({ destroyOnReturn: false }));
+        const { token } = await resolveUpstreamEndpoints(auth);
+        const upstream = await forwardTokenRequest(
+          body.toString("utf8"),
+          req.headers.authorization,
+          token
+        );
+        res.writeHead(upstream.status, { "Content-Type": upstream.contentType });
+        res.end(upstream.body);
+      } catch (error) {
+        if (error instanceof HttpInputError) {
+          res.writeHead(error.status, { "Content-Type": "application/json", Connection: "close" });
+          res.end(JSON.stringify({ error: "invalid_request", error_description: error.message }));
+          return;
+        }
+        console.error(`Token request could not be forwarded: ${error}`);
+        res.writeHead(502, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "authorization_server_unavailable" }));
+      }
+      return;
+    }
+    if (req.url !== "/mcp") {
+      res.writeHead(404);
+      res.end("Not found");
+      return;
+    }
+    if (auth) {
+      const result = await verifyBearer(req.headers.authorization, auth);
+      if (result.ok) {
+        callerLabel = result.caller ?? result.subject ?? "authenticated";
+      }
+      if (!result.ok) {
+        res.writeHead(result.status, {
+          "Content-Type": "application/json",
+          "WWW-Authenticate": wwwAuthenticate(auth, result)
+        });
+        res.end(JSON.stringify({ error: result.error, error_description: result.description }));
+        return;
+      }
+    }
+    let parsedBody;
+    if (req.method === "POST") {
+      try {
+        parsedBody = parseMcpBody(await readHttpBody(req.iterator({ destroyOnReturn: false })));
+      } catch (error) {
+        const status = error instanceof HttpInputError ? error.status : 400;
+        res.writeHead(status, { "Content-Type": "application/json", Connection: "close" });
+        res.end(JSON.stringify({ jsonrpc: "2.0", id: null, error: {
+          code: -32600,
+          message: error instanceof HttpInputError ? error.message : "Invalid JSON"
+        } }));
+        return;
+      }
+    }
+    const sessionId = req.headers["mcp-session-id"];
+    if (sessionId && sessions.has(sessionId)) {
+      const session = sessions.get(sessionId);
+      await session.transport.handleRequest(req, res, parsedBody);
+      return;
+    }
+    if (req.method === "POST" && !sessionId) {
+      const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: () => crypto.randomUUID()
+      });
+      const server = createServer();
+      transport.onclose = () => {
+        const sid = transport._sessionId;
+        if (sid) sessions.delete(sid);
+        server.close();
+      };
+      await server.connect(transport);
+      await transport.handleRequest(req, res, parsedBody);
+      const newSessionId = res.getHeader("mcp-session-id");
+      if (newSessionId) {
+        sessions.set(newSessionId, { server, transport });
+      }
+      return;
+    }
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: "Invalid or missing session" }));
+  };
+}
+async function startHttp() {
+  const port = parseInt(process.env.PORT || "3000", 10);
+  const auth = getAuthConfig();
+  const httpServer = createHttpServer(createHttpHandler());
+  httpServer.listen(port, () => {
+    const mode = auth ? `OAuth required (issuer ${auth.issuer})` : "unauthenticated";
+    console.error(`Bitbucket MCP Server v${VERSION} started (http) on port ${port} \u2014 ${mode}`);
+  });
+}
 async function main() {
   try {
     getSettings();
@@ -2965,12 +3725,19 @@ async function main() {
     console.error("Configuration error:", error instanceof Error ? error.message : error);
     process.exit(1);
   }
-  const server = createServer();
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-  console.error(`Bitbucket MCP Server v${VERSION} started`);
+  const transport = process.env.MCP_TRANSPORT || (process.argv.includes("--http") ? "http" : "stdio");
+  if (transport === "http") {
+    await startHttp();
+  } else {
+    await startStdio();
+  }
 }
-main().catch((error) => {
-  console.error("Fatal error:", error);
-  process.exit(1);
-});
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+  main().catch((error) => {
+    console.error("Fatal error:", error);
+    process.exit(1);
+  });
+}
+export {
+  createHttpHandler
+};